Blocco portatile dopo l'avvio

[FDAC]

Scarica <b>Combofix</b> da qui:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Quando lo salvi hai la possibilità di rinominare il file: rinomina l’exe in pippo.exe

● posiziona pippo.exe sul Desktop
● disconnettiti da Internet
● sconnetti, fisicamente, il modem dal computer
● accedi al sistema in modalità provvisoria con un account con privilegi di <b>Amministratore</b>
● lancia <b>ComboFix </b>e segui le istruzioni che verranno rilasciate per eseguire la scansione
● senza eseguire altre operazioni, lascia che il tool completi la scansione e la fase di creazione del log
● al termine della operazione, il sistema verrà riavviato automaticamente (in caso contrario, riavvialo tu)

Note - durante la scansione:
● verranno creati alcuni file sul desktop e poi eliminati
● spariranno, per un attimo, tutte le icone presenti sul Desktop
● potrebbe venire rilasciato un messaggio in relazione all'<b>antivirus</b> in uso: <b>prosegui ignorando il messaggio</b>
● il firewall, se attivo, potrebbe rilasciare un avviso che verranno rimossi alcuni driver (consenti pure)

Verrà creato un log in Disco Locale C: dal nome <b>combofix.txt </b>che dovrai inviare qui.

Conclusa la scansione:
● riavvia il sistema in modalità normale
● ricollega, fisicamente, il modem al computer
● connettiti a Internet e invia il file di testo

N.B. Se non riuscissi in alcun modo ad utilizzare Combofix, segui questi semplici passi:

start > esegui, nel box bianco copia e incolla questo comando, virgolette comprese:
"%userprofile%\desktop\pippo.exe" /killall
Premi OK, si dovrebbe avviare la scansione.

[caioddu]

Fatto tutto come da istruzioni!
Qui di seguito il contenuto di ComboFix.txt:

ComboFix 10-09-17.04 - Lulù 18/09/2010 12:46:02.1.2 - x86 MINIMAL
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.39.1040.18.3071.2297 [GMT 2:00]
Eseguito da: c:\users\Lulù\Desktop\pippo.exe
* Creato nuovo punto di ripristino
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ps2.bat

.
((((((((((((((((((((((((( Files Creati Da 2010-08-18 al 2010-09-18 )))))))))))))))))))))))))))))))))))
.

2010-09-18 10:50 . 2010-09-18 10:50 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-09-18 09:57 . 2010-08-21 05:32 316928 ----a-w- c:\windows\system32\spoolsv.exe
2010-09-18 08:52 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-18 08:52 . 2010-09-18 08:52 -------- d-----w- c:\programdata\Malwarebytes
2010-09-18 08:52 . 2010-09-18 08:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-18 08:52 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-16 16:07 . 2010-09-16 16:07 797200 begin_of_the_skype_highlighting              07 797200      end_of_the_skype_highlighting ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.459\updater.dll
2010-09-16 16:07 . 2010-09-16 16:07 797272 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\updater.dll
2010-09-15 14:51 . 2010-09-15 14:51 -------- d-----w- c:\program files\Trend Micro
2010-09-04 20:45 . 2010-09-04 20:45 -------- d-----w- c:\programdata\Messenger Plus!
2010-09-04 20:45 . 2010-09-04 20:45 -------- d-----w- c:\program files\Messenger Plus! Live
2010-09-04 08:33 . 2010-09-04 08:33 -------- d-----w- c:\programdata\ATI
2010-09-04 08:09 . 2010-09-04 08:09 -------- d-----w- C:\ATI
2010-09-04 08:07 . 2010-09-04 08:07 -------- d-----w- C:\AMD
2010-09-03 21:56 . 2010-09-04 08:33 -------- d-----w- c:\program files\ATI Technologies
2010-09-03 21:56 . 2010-09-03 21:56 -------- d-----w- c:\program files\ATI
2010-09-03 21:54 . 2010-08-04 01:49 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2010-09-03 21:54 . 2010-08-04 01:28 4021760 ----a-w- c:\windows\system32\atiumdag.dll
2010-09-03 21:54 . 2010-08-04 01:21 3324416 ----a-w- c:\windows\system32\atiumdva.dll
2010-09-03 21:54 . 2008-03-09 19:32 3107788 ----a-w- c:\windows\system32\atiumdva.dat
2010-09-03 21:54 . 2010-08-04 01:49 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-09-03 21:54 . 2008-03-09 20:00 253952 ------w- c:\windows\system32\Ati2evxx.dll
2010-09-03 21:54 . 2008-03-09 19:59 655360 ------w- c:\windows\system32\Ati2evxx.exe
2010-09-03 21:54 . 2008-03-04 17:02 90112 ----a-w- c:\windows\system32\atibrtmon.exe
2010-09-02 15:13 . 2010-09-02 15:13 -------- d-----w- c:\program files\Seagate
2010-09-02 09:03 . 2001-07-03 11:13 81920 ----a-w- c:\windows\system32\ps2.EXE
2010-09-02 09:02 . 2010-09-02 09:03 -------- d-----w- C:\hp
2010-09-02 09:02 . 2001-06-04 04:00 14112 ----a-w- c:\windows\system32\drivers\PS2.sys
2010-09-02 08:51 . 2009-10-05 07:31 1221632 ----a-w- c:\windows\system32\drivers\athr.sys
2010-09-02 08:51 . 2009-10-05 07:31 1221632 ----a-w- c:\windows\system32\athr.sys
2010-09-02 08:51 . 2010-09-02 08:51 -------- d-----w- c:\windows\Options
2010-09-02 08:51 . 2010-09-02 08:51 -------- d-----w- c:\program files\Atheros
2010-09-02 08:51 . 2010-09-02 08:51 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-02 08:50 . 2010-09-02 08:51 -------- d-----w- c:\programdata\Atheros
2010-09-02 08:48 . 2010-09-02 08:46 8 ----a-w- c:\windows\system32\drivers\rtkhdaud.dat
2010-09-02 08:48 . 2010-09-02 08:46 520 ----a-w- c:\windows\system32\drivers\RTEQEX2.dat
2010-09-02 08:48 . 2010-09-02 08:46 520 ----a-w- c:\windows\system32\drivers\RTEQEX1.dat
2010-09-02 08:48 . 2010-09-02 08:46 520 ----a-w- c:\windows\system32\drivers\RTEQEX0.dat
2010-09-02 08:48 . 2010-09-02 08:46 189796 ----a-w- c:\windows\system32\drivers\RTConvEQ.dat
2010-09-02 08:48 . 2010-09-02 08:46 1112 ----a-w- c:\windows\system32\drivers\RtHdatEx.dat
2010-09-02 08:48 . 2010-09-02 08:48 -------- d-----w- c:\program files\Realtek
2010-09-02 08:48 . 2010-09-02 08:50 -------- d--h--w- c:\program files\Temp
2010-09-01 23:27 . 2010-09-01 23:27 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-09-01 23:25 . 2010-09-01 23:25 -------- d-----w- c:\program files\MSXML 4.0
2010-09-01 23:18 . 2010-09-01 23:18 -------- d-----w- c:\program files\Microsoft
2010-09-01 23:17 . 2010-09-01 23:17 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-09-01 23:17 . 2010-09-01 23:18 -------- d-----w- c:\program files\Windows Live
2010-09-01 23:14 . 2010-09-01 23:14 -------- d-----w- c:\program files\Common Files\Windows Live
2010-09-01 22:44 . 2010-09-01 22:56 -------- d-----w- c:\program files\Nero
2010-09-01 22:44 . 2010-09-01 23:05 -------- d-----w- c:\program files\Common Files\Nero
2010-09-01 22:44 . 2010-09-01 22:51 -------- d-----w- c:\programdata\Nero
2010-09-01 22:16 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-09-01 22:16 . 2008-11-10 09:41 32656 ----a-w- c:\windows\system32\msonpmon.dll
2010-09-01 22:16 . 2006-10-26 17:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-09-01 22:15 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-09-01 22:15 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-09-01 22:15 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-09-01 22:15 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-09-01 22:15 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-09-01 22:14 . 2010-09-01 23:28 -------- d-----w- c:\program files\Microsoft Works
2010-09-01 22:11 . 2010-09-02 08:13 -------- d-----w- c:\program files\Microsoft.NET
2010-09-01 22:11 . 2010-09-01 22:11 -------- d-----w- c:\windows\PCHEALTH
2010-09-01 22:08 . 2010-09-01 22:08 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2010-09-01 22:06 . 2010-09-18 10:00 -------- d-----w- c:\programdata\Microsoft Help
2010-09-01 22:06 . 2010-09-01 22:06 -------- d-----r- C:\MSOCache
2010-09-01 22:05 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-09-01 21:47 . 2010-09-01 21:47 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-01 21:47 . 2010-09-01 21:47 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-09-01 21:46 . 2010-09-01 21:47 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-09-01 21:45 . 2010-09-01 21:45 -------- d-----w- c:\program files\Common Files\Adobe
2010-09-01 21:43 . 2010-09-01 21:43 -------- d-----w- c:\windows\system32\Macromed
2010-09-01 21:42 . 2010-09-01 21:06 -------- d-----w- c:\windows\Panther
2010-09-01 21:42 . 2010-09-01 23:46 -------- d-----w- C:\Boot
2010-09-01 21:33 . 2010-09-01 21:33 932368 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2010-09-01 21:33 . 2010-09-01 21:33 678416 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2010-09-01 21:33 . 2010-09-01 21:33 604688 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2010-09-01 21:33 . 2010-09-01 21:33 522768 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2010-09-01 21:33 . 2010-09-01 21:33 1096208 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2010-09-01 21:32 . 2010-09-01 21:32 15376 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\clldr.dll
2010-09-01 21:32 . 2010-09-01 21:32 170584 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\prloader.dll
2010-09-01 21:32 . 2010-09-01 21:32 311680 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\avp.exe
2010-09-01 21:32 . 2010-09-01 21:32 59920 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2010-09-01 21:32 . 2010-09-01 21:32 264720 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2010-09-01 21:32 . 2010-09-01 21:32 129624 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mmpprtc.dll
2010-09-01 21:32 . 2010-09-01 21:32 109072 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2010-09-01 21:32 . 2010-09-01 21:32 280592 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\sys\i386\6.0\klif.sys
2010-09-01 21:32 . 2010-09-01 21:32 128016 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\sys\i386\kl1.sys
2010-09-01 21:24 . 2010-09-01 21:24 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
2010-09-01 21:22 . 2010-09-01 21:32 97549 ----a-w- c:\windows\system32\drivers\klick.dat
2010-09-01 21:22 . 2010-09-01 21:32 113933 ----a-w- c:\windows\system32\drivers\klin.dat
2010-09-01 21:22 . 2010-06-14 06:12 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-09-01 21:20 . 2010-03-05 07:42 67584 ----a-w- c:\windows\system32\asycfilt.dll
2010-09-01 21:19 . 2010-01-18 23:29 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-09-01 21:19 . 2010-01-18 23:29 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-09-01 21:19 . 2010-01-18 23:29 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2010-09-01 21:19 . 2010-01-18 23:29 369152 ----a-w- c:\windows\system32\secproc.dll
2010-09-01 21:19 . 2010-01-18 23:28 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-09-01 21:19 . 2010-01-18 23:28 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-09-01 21:19 . 2010-01-18 23:28 320512 ----a-w- c:\windows\system32\RMActivate.exe
2010-09-01 21:19 . 2010-01-18 23:28 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-09-01 21:19 . 2010-04-23 07:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-01 21:19 . 2010-06-16 05:48 224256 ----a-w- c:\windows\system32\schannel.dll
2010-09-01 21:19 . 2010-02-27 07:32 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-09-01 21:19 . 2010-02-27 07:32 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-09-01 21:19 . 2010-02-27 07:32 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-09-01 21:18 . 2010-06-19 04:07 2326016 ----a-w- c:\windows\system32\win32k.sys
2010-09-01 21:13 . 2010-05-27 07:24 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-09-01 21:13 . 2010-05-27 03:49 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 21:13 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-09-01 21:11 . 2010-05-21 12:14 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-09-01 21:10 . 2009-12-29 06:55 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-09-01 21:10 . 2010-01-09 06:52 132608 ----a-w- c:\windows\system32\cabview.dll
2010-09-01 21:06 . 2010-09-01 23:20 -------- d-----w- c:\users\Lulù
2010-09-01 20:58 . 2010-09-11 20:45 -------- d-----w- c:\windows\system32\wbem\Performance
2010-09-01 20:46 . 2010-09-01 20:46 0 ----a-w- c:\windows\ativpsrm.bin

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 10:40 . 2010-09-01 21:21 -------- d-----w- c:\programdata\Kaspersky Lab
2010-09-11 20:45 . 2009-07-14 08:21 698570 ----a-w- c:\windows\system32\perfh010.dat
2010-09-11 20:45 . 2009-07-14 08:21 127764 ----a-w- c:\windows\system32\perfc010.dat
2010-09-06 15:26 . 2010-09-06 15:26 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-09-02 08:52 . 2010-09-02 08:52 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01009.Wdf
2010-09-02 08:47 . 2007-10-01 12:59 1769984 ----a-w- c:\windows\system32\drivers\snp2uvc.sys
2010-09-02 08:47 . 2007-09-15 07:22 371 ----a-w- c:\windows\Uninstvga.bat
2010-09-02 08:47 . 2007-09-15 07:22 372 ----a-w- c:\windows\Uninstsxga.bat
2010-09-02 08:47 . 2007-09-15 07:01 386 ----a-w- c:\windows\Uninstsxga.reg
2010-09-02 08:47 . 2007-09-15 07:01 384 ----a-w- c:\windows\Uninstvga.reg
2010-09-02 08:47 . 2007-05-09 13:16 28160 ----a-w- c:\windows\system32\drivers\sncduvc.sys
2010-09-02 08:47 . 2006-11-23 20:20 11776 ----a-w- c:\windows\DrvInst.exe
2010-09-01 22:35 . 2009-07-14 02:37 -------- d-----w- c:\program files\Windows Mail
2010-09-01 22:13 . 2009-07-14 04:52 -------- d-----w- c:\program files\MSBuild
2010-09-01 21:32 . 2009-05-24 13:30 128016 ----a-w- c:\windows\system32\drivers\kl1.sys
2010-09-01 21:21 . 2010-09-01 21:21 -------- d-----w- c:\program files\Kaspersky Lab
2010-09-01 21:20 . 2010-09-01 21:20 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2010-09-01 21:05 . 2010-09-01 21:05 -------- d-sh--we c:\programdata\Preferiti
2010-09-01 21:05 . 2010-09-01 21:05 -------- d-sh--we c:\programdata\Modelli
2010-09-01 21:05 . 2010-09-01 21:05 -------- d-sh--we c:\programdata\Menu Avvio
2010-09-01 21:05 . 2010-09-01 21:05 -------- d-sh--we c:\programdata\Documenti
2010-09-01 21:05 . 2010-09-01 21:05 -------- d-sh--we c:\programdata\Dati applicazioni
2010-09-01 21:05 . 2010-09-01 21:05 -------- d-sh--we c:\program files\File comuni
2010-09-01 20:45 . 2010-09-01 20:45 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-08-04 02:21 . 2010-08-04 02:21 6096384 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-08-04 01:55 . 2010-08-04 01:55 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-08-04 01:54 . 2010-08-04 01:54 519680 ----a-w- c:\windows\system32\aticfx32.dll
2010-08-04 01:52 . 2010-08-04 01:52 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-08-04 01:51 . 2010-08-04 01:51 380928 ----a-w- c:\windows\system32\atieclxx.exe
2010-08-04 01:51 . 2010-08-04 01:51 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2010-08-04 01:50 . 2010-08-04 01:50 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2010-08-04 01:49 . 2010-08-04 01:49 15845888 ----a-w- c:\windows\system32\atioglxx.dll
2010-08-04 01:49 . 2010-08-04 01:49 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2010-08-04 01:49 . 2010-08-04 01:49 11776 ----a-w- c:\windows\system32\atimuixx.dll
2010-08-04 01:46 . 2009-07-13 22:09 3899392 ----a-w- c:\windows\system32\atidxx32.dll
2010-08-04 01:26 . 2010-08-04 01:26 46080 ----a-w- c:\windows\system32\aticalrt.dll
2010-08-04 01:25 . 2010-08-04 01:25 44032 ----a-w- c:\windows\system32\aticalcl.dll
2010-08-04 01:24 . 2010-08-04 01:24 4341248 ----a-w- c:\windows\system32\aticaldd.dll
2010-08-04 01:23 . 2010-08-04 01:23 65536 ----a-w- c:\windows\system32\coinst.dll
2010-08-04 01:16 . 2010-08-04 01:16 241664 ----a-w- c:\windows\system32\atiadlxx.dll
2010-08-04 01:15 . 2010-08-04 01:15 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-08-04 01:15 . 2010-08-04 01:15 16896 ----a-w- c:\windows\system32\atigktxx.dll
2010-08-04 01:15 . 2010-08-04 01:15 214016 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-08-04 01:15 . 2010-08-04 01:15 30208 ----a-w- c:\windows\system32\atiuxpag.dll
2010-08-04 01:14 . 2010-08-04 01:14 27648 ----a-w- c:\windows\system32\atiu9pag.dll
2010-08-04 01:14 . 2010-08-04 01:14 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-08-04 01:09 . 2010-08-04 01:09 52736 ----a-w- c:\windows\system32\atimpc32.dll
2010-08-04 01:09 . 2010-08-04 01:09 52736 ----a-w- c:\windows\system32\amdpcom32.dll
2010-07-29 06:30 . 2010-09-01 21:21 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-09-01 21:21 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-06-30 06:25 . 2010-09-01 21:20 978432 ----a-w- c:\windows\system32\wininet.dll
2010-06-22 02:47 . 2010-09-01 21:20 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-22 02:47 . 2010-09-01 21:20 307200 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-06-22 02:47 . 2010-09-01 21:20 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-03 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 13:57 948672 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-21 23:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 09:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2001-07-06 11:56 61440 ----a-w- c:\hp\kbd\kbd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 20:11 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
2001-07-03 11:13 81920 ----a-w- c:\windows\System32\ps2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-12-15 33808]
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-01 691696]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-05-15 21008]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-08-04 176128]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-08-04 6096384]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-08-04 214016]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-05-16 19472]
R3 SiSGbeLH;Driver NDIS 6.0 dispositivo Ethernet SiS191/SiS190;c:\windows\system32\DRIVERS\SiSGB6.sys [2009-07-13 48128]

.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKLM-RunOnce-<NO NAME> - (no file)


.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Ora fine scansione: 2010-09-18 12:51:29
ComboFix-quarantined-files.txt 2010-09-18 10:51

Pre-Run: 80.581.959.680 byte disponibili
Post-Run: 80.527.396.864 byte disponibili

- - End Of File - - 58B3F3CE82DE2885CEDF7A53B70F6BFD

[FDAC]

Combofix ha eliminato qualcosa.
Il PC come va?
Sintomi?

[caioddu]

Per ora tutto ok... ma, mediamente, si blocca ogni due giorni.
Ti farò sapere.
Intanto grazie mille.
Ciao

[FDAC]

Aspetta, non abbiamo finito.
Disinstalla:

Messenger Plus!

POI

Digita:

Start\Esegui\copia e incolla la stringa %temp% clicca su Ok, svuota la cartella temp dai file. (non eliminare la cartella)

Provvedi a svuotare del suo contenuto la cartella Prefetch :
clicca su Risorse del Computer
clicca su Disco locale C:
cerca, all’interno delle cartelle che saranno visualizzate la cartella Windows, aprila ed, al suo interno, cerca la cartella Prefetch, la apri ed elimina tutte le voci conservate al suo interno ( non eliminare la cartella )

Svuota poi la cache di Java:

http://www.java.com/it/download/help/plugin_cache.xml


SVUOTA IL CESTINO

Lancia Hijackthis e pulisci gli ADS in questo modo:
clicca sulla voce Open the misc tool section
clicca su Open ads spy
togli la spunta alla voce Quick scan (windows base folder only)
clicca su Scan.
Aspetta pazientemente la fine della scansione.
se venissero rilevati ADS, spunta tutte (senza paura) le caselline e clicca su Remove selected

[caioddu]

Fatto! Di Java non ho eliminato niente perché non installato. Poi, tra gli ADS di HijackThis non ne ha eliminato 5 di Kaspersky Lab.

[FDAC]

Fammi sapere, saluti.

[caioddu]

Perfetto! Ancora grazie. Ti farò sapere...
Ciao

[caioddu]

Brutte notizie... si è bloccato nuovamente!

[everi]

...ma hai fatto un controllo del disco per vedere se ci sono errori....e poi una deframmentazione?

[caioddu]

Sto facendo controllo disco e deframmentazione...
Ho ricontrollato nel registro eventi e nel momento appena successivo al blocco mi indica:

Nome registro: System
Origine: EventLog
Data: 20/09/2010 15:46:31
ID evento: 6008
Categoria attività:Nessuna
Livello: Errore
Parole chiave: Classico
Utente: N/D
Computer: Luca-PC
Descrizione:
Precedente arresto del sistema inatteso a 15:40:08 su ‎20/‎09/‎2010.
XML evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="EventLog" />
<EventID Qualifiers="32768">6008</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-09-20T13:46:31.000000000Z" />
<EventRecordID>21977</EventRecordID>
<Channel>System</Channel>
<Computer>Luca-PC</Computer>
<Security />
</System>
<EventData>
<Data>15:40:08</Data>
<Data>‎20/‎09/‎2010</Data>
<Data>
</Data>
<Data>
</Data>
<Data>17503</Data>
<Data>
</Data>
<Data>
</Data>
<Binary>DA070900010014000F00280008003602DA070900010014000D00280008003602080700003C0000000100000008070000000000005802000001000000B6190000</Binary>
</EventData>
</Event>

[FDAC]

Prova a postare un log AGGIORNATO di Hijackthis.

[caioddu]

Logfile of Trend Micro HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:00, on 20/09/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Aggiungi ad Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: &Tastiera Virtuale - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: C&ontrollo URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

--
End of file - 3539 bytes

[FDAC]

Il Kaspersky è originale?

[caioddu]

Sì, con la licenza originale

[FDAC]

Va bene.
Rilancia Hijackthis e:
- spunta la casellina fianco di ogni singola voce che ti indicherò sotto
- una volta spuntate le voci:
- chiudi tutte le applicazioni aperte
- chiudi tutte le pagine del browser aperte
- in Hijakthis fixa le voci cliccando su Fix checked

Queste le voci da fixare:

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Scarica MBRCheck, e e salvalo sul desktop.
http://ad13.geekstogo.com/MBRCheck.exe
Chiudi tutti i programmi.
Doppio click su MBRCheck, che hai scaricato sul desktop, ed eseguilo.
Attendi la fine della scansione.
Finita la scansione (dura pochissimo) ti appare nella finestra questa scritta in verde:
Windows xp MBR code detected.

Se invece ti appare questa scritta:
Found non-standard or infected MBR.
L'MBR è infetto.

[caioddu]

Fatto. Mi compare la scritta verde: Windows 7 MBR code detected

[FDAC]

L'MBR è a posto.

Disinstalla Combofix: scarica sul desktp OTC by OldTimer:
http://oldtimer.geekstogo.com/OTC.exe
- doppio clic sulla icona per lanciarlo - clicca su CleanUP
- quando ha terminato, riavvia il computer

Scarica ed installa HitmanPro (scegli la versione adatta al tuo S.O. - 32Bit o 64Bit):
http://www.surfright.nl/en/downloads
- lascia le impostazioni di default e lancia la scansione (attiva anche la licenza, sarà valida per 30 giorni);
- al termine della scansione (sarà velocissima, 3/4 minuti al massimo) ti verrà mostrato una finestra di riepilogo: nella finestra di riepilogo, in basso a sinistra, avrai modo di salvare il Report generato
- invia qui sul forum il log del programma

Esegui uno Scandisk:

? Risorse del computer
? tasto destro del mouse su Disco Locale C:
? Proprietà
? Strumenti
? Esegui Scandisk
? spunta le voci Correggi automaticamente gli errori del file System e Cerca Settori danneggiati e lancia lo scandisk
? verrà pianificato lo scandisk e ti verrà chiesto di riavviare il sistema
? dopo il riavvio, verrà eseguito automaticamente lo scandisk
? lascia che tutte le fasi vengano completate (il computer si avvierà da solo), non avere fretta perché l'operazione potrebbe durare circa un'ora e, soprattutto, non la interrompere.
? al termine riavvia il sistema: dopo il riavvio si potrebbe presentare una finestra di Windows: spunta l'unica casella disponibile e clicca su OK per confermare.

Una volta eseguito lo scandisk, esegui una deframmentazione del disco:
? Start
? tutti i Programmi
? Accessori
? Utilità di Sistema
? clicca sulla voce Utilità di deframmentazione dischi e lancia la deframmentazione

Infine, sempre da Utilità di Sistema, esegui una Pulizia Disco

[caioddu]

Fatto! HitmanPro non ha rilevato nessuna minaccia. Comincio a pensare sia un problema di hardware... Non credi?

[FDAC]

Abbiamo fatto molte scansioni, il mio lavoro penso sia finito qui:
Probabilmente hai ragione tu.